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STATEMENT OF THE CASE 
The Appellants seek our review under 35 U.S.C. § 134 (2002) of the 
final rejection of claims 1, 3-4, 16-18, 20, 22-24, and 26-27 which are all the 
claims pending in the application. We have jurisdiction under 35 U.S.C. 
§ 6(b) (2002). 

SUMMARY OF THE DECISION 
We REVERSE. 

THE INVENTION 
The Appellants' claimed invention is directed a method for permitting 
a patient to have controlled access to their medical records (Spec. [0007]). 
Claim 1, reproduced below with the numbering in brackets added, is 
representative of the subject matter on appeal. 

1 . A computer-implemented method of permitting controlled 
access to medical information of a patient, the method comprising: 

supplying medical information of the patient to a central 
repository by the patient and any medical providers who have treated 
the patient; 

storing and maintaining the medical information of the patient 
in the central repository; 

accessing the medical information by the patient from an 
access device using a unique patient identifier and a patient PIN; 

controlling by the patient an authorization and a scope of 
access to the medical information by modifying an access control list 
within the patient's profile when the patient is connected to the central 
repository, wherein the access control list lists each authorized user 
and the assigned role of each authorized user, wherein the scope of 
access includes which items of medical information are available to an 
assigned role and how that information will be viewed; 
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[1] assigning each authorized user with a unique authorized 
user ID and an authorized user PIN; [2] and 

tracking and notifying the patient of an identity of a user who 
accessed the medical information, information that was accessed by 
the user, and when the user accessed the information. 

THE REJECTIONS 
The Examiner relies upon the following as evidence in support of the 
rejections: 

Felsher US 2002/0010679 Al Jan. 24, 2002 

Hacker US 6,998,075 B 1 Jan. 1 7, 2006 

Mandl et al, Public standards and patients ' control: how to keep 
electronic medical records accessible but private, BMJ, Volume 322, 
Feb. 3,2001. 

The following rejections are before us for review: 

1. Claims 1,3-4, 20, 22-24, and 26-27 are rejected under 35 
U.S.C. § 103(a) as unpatentable over Hacker and Mandl. 

2. Claims 16-18 are rejected under 35 U.S.C. § 103(a) as 
unpatentable over Hacker, Mandl, and Fleshier. 

THE ISSUES 

With regards to claim 1 the issue turns on whether Hacker discloses 
claim limitation [1]. The remaining claims turn on a similar issue. 
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FINDINGS OF FACT 
We find the following enumerated findings of fact (FF) are supported 
at least by a preponderance of the evidence: 1 

FF1. Hacker has disclosed a patient controlled medical information system 
and method (Title). 

FF2. Hacker at Col. 7:43-66 does not disclose "assigning each authorized 
user with a unique authorized user ID and an authorized user PIN" where the 
user is authorized to access the patients' medical records. 

ANALYSIS 

The Appellants argue that the rejection of claim 1 is improper because 
Hacker does not disclose claim limitation [1] (Br. 7-9, Reply Br. 2, 4). 

In contrast, the Examiner has determined that Hacker discloses the 
cited claimed limitation at Col. 7:43-66 (Ans. 4, 7-8). The Examiner has 
determined that the claim limitations do not differentiate between the 
"patient identifier" and "authorized user ID" (Ans. 7). 

We agree with the Appellants. Claim 1 requires both a: 1) "unique 
patient identifier and a patient PIN", and 2) "a unique authorized user ID and 
an authorized user PIN" for each authorized user who accesses the medical 
records. Thus, the claims do require that the user accessing the patients' 
medical records is assigned a "user ID" and "user PIN" that is different from 
the "patient identifier" or "patient PIN". The Examiner has determined that 
Hacker discloses claim limitation [1] at Col. 7:43-66. Hacker at Col. 7:43- 
66 does not disclose claim limitation [1] (FF2) as asserted and the rejection 

1 See Ethicon, Inc. v. Quigg, 849 F.2d 1422, 1427 (Fed. Cir. 1988) 
(explaining the general evidentiary standard for proceedings before the 
Patent Office). 
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of claim 1 is therefore not sustained. While Hacker at Col. 7:43-66 discloses 
patient identification and access and the use of passphrases it is not 
specifically disclosed that a user accessing the patients records is granted a 
"user ID" or "user PIN" as claimed. The remaining claims contain a similar 
limitation and the rejection of these claims is not sustained for these same 
reasons. 

CONCLUSIONS OF LAW 
We conclude that Appellants have shown that the Examiner erred in 
rejecting: claims 1, 3-4, 16-18, 20, 22-24, and 26-27 under 35 U.S.C. 
§ 103(a) as unpatentable over Felsher, Hacker, and Mandl; and claims 16-18 
under 35 U.S.C. § 103(a) as unpatentable over Hacker, Mandl, and Flesher. 

DECISION 

The Examiner's rejection of claims 1, 3-4, 16-18, 20, 22-24, and 26- 
27 is reversed. 

REVERSED 
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